Ciphertext hierarchical single-hop proxy re-encryption method

Abstract

The application relates to the field of cryptography, and discloses a ciphertext hierarchical single-hop proxy re-encryption method and a ciphertext hierarchical single-hop proxy re-encryption method for a fine-grained proxy function set. The ciphertext hierarchical single-hop proxy re-encryption method for the fine-grained proxy function set comprises the following steps: key generation, primary encryption, secondary encryption, fine-grained proxy key generation, proxy re-encryption, primary ciphertext decryption and secondary ciphertext decryption. The primary ciphertext can be re-encrypted into secondary ciphertext, and the secondary ciphertext cannot be re-encrypted. The ciphertext hierarchical single-hop proxy re-encryption method with post-quantum security and capable of simultaneously encrypting multi-bit plaintext has higher security, higher encryption efficiency, can realize fine-grained ciphertext decryption authorization, and can enable a user to freely select whether ciphertext can be re-encrypted, thereby being capable of blocking further ciphertext conversion.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cryptography, in particular to a ciphertext hierarchical single-hop proxy re-encryption method and a ciphertext hierarchical single-hop proxy re-encryption method for a fine-grained proxy function set. BACKGROUND

[0002] In a traditional public key encryption scheme, plaintext information is encrypted into ciphertext with the help of a public key, and the ciphertext can be transmitted in a public channel. Only the owner of the corresponding private key can decrypt the ciphertext to obtain the plaintext information. In this process, the ciphertext corresponds to a set of public and private keys, and ciphertext C facing user A cannot be decrypted by user B. If the plaintext information of ciphertext C facing user A is securely delivered to user C, user A needs to perform ciphertext conversion through "decryption-re-encryption". However, this method has the following disadvantages: user A must participate in real time, and the intermediate decryption process has the risk of leaking plaintext.

[0003] Proxy re-encryption can avoid the disadvantages of the above ciphertext conversion method. Users can generate conversion keys between themselves and other users and give the conversion keys to a proxy. The proxy efficiently converts ciphertext C facing user A A into ciphertext C facing user B B through a proxy re-encryption algorithm. In the proxy re-encryption scheme, the ciphertext C A before conversion and the ciphertext C B after conversion are both encryptions of the same plaintext. The conversion key between user A and user B does not leak the private key information of user A and user B. For example, when a company manager is on a business trip / vacation and encounters encrypted emails that need to be processed, he can convert the encrypted emails he receives into encrypted emails corresponding to the public key of his secretary with the help of a proxy, and then directly forward them to the secretary for decryption and processing.

[0004] However, if there are enough proxy keys, user A has no way to control the propagation chain of his own ciphertext. For example, after ciphertext facing user A is converted into ciphertext facing user B, user B converts this ciphertext into ciphertext facing user V. Although user A may not want user B to perform further re-encryption operations, he has no way to prevent user B from doing so in a multi-hop proxy re-encryption scheme. Meanwhile, in the case where some proxy keys have been generated, the proxy can always convert ciphertext facing user A into ciphertext facing user B with the help of the proxy key, regardless of whether user A wants to perform this operation or not.

[0005] Therefore, there is an urgent need for a new ciphertext hierarchical single-hop proxy re-encryption method with post-quantum security and encrypted multi-bit plaintext, which has higher security, higher encryption efficiency, can realize fine-grained ciphertext decryption authorization, and can enable users to freely choose whether the ciphertext can be re-encrypted, thereby blocking further ciphertext conversion. SUMMARY

[0006] The purpose of the present application is to provide a ciphertext hierarchical single-hop proxy re-encryption method with post-quantum security and capable of encrypting multi-bit plaintext at the same time, which has higher security, higher encryption efficiency, can realize fine-grained ciphertext decryption authorization, and can enable users to freely choose whether the ciphertext can be re-encrypted, thereby blocking further ciphertext conversion.

[0007] To solve the above technical problems, the embodiments of the present application disclose a ciphertext hierarchical single-hop proxy re-encryption method, comprising the following steps:

[0008] Key generation, inputting a security parameter into a key generation algorithm to generate a pair of public and private keys;

[0009] Primary encryption, inputting a public key and plaintext into a primary encryption algorithm to generate primary ciphertext corresponding to the plaintext;

[0010] Secondary encryption, inputting a public key and plaintext into a secondary encryption algorithm to generate secondary ciphertext corresponding to the plaintext;

[0011] Proxy key generation, inputting a principal's public and private keys and a delegatee's public key into a proxy key generation algorithm to generate a principal-to-delegatee proxy key;

[0012] Proxy re-encryption, inputting primary ciphertext facing the principal and the proxy key into a re-encryption algorithm to generate secondary ciphertext facing the delegatee;

[0013] Primary ciphertext decryption, inputting the primary ciphertext and the corresponding private key into a primary ciphertext decryption algorithm to obtain plaintext corresponding to the primary ciphertext;

[0014] Secondary ciphertext decryption, inputting the secondary ciphertext and the corresponding private key into a secondary ciphertext decryption algorithm to obtain plaintext corresponding to the secondary ciphertext;

[0015] Wherein, the primary ciphertext can be re-encrypted into secondary ciphertext, and the secondary ciphertext cannot be re-encrypted again;

[0016] Wherein, the formula of the key generation algorithm is: (sk, pk) <- KeyGen(1 λ , which takes the security parameter 1 λ as input to generate a pair of public and private keys (sk, pk).

[0017] The step of key generation specifically comprises:

[0018] calling a trapdoor generation algorithm TrapGen to generate a matrix and a trapdoor T; wherein the formula of the trapdoor generation algorithm TrapGen is: wherein the trapdoor generation algorithm takes parameters n, q as input, satisfying q≥2, representing a natural number set, wherein T is a small norm matrix with a dimension of N×N, representing an integer set, representing a set of residue classes of the integer set modulo q;

[0019] randomly generating obtained by matrix splicing:

[0020]

[0021] randomly selecting randomly selecting public parameters calculating

[0022] setting the public key as pk=(A, A ′), setting the private key as sk=(T,K), and outputting a public-private key pair (sk, pk);

[0023] wherein the formula of the first-level encryption algorithm is: The first-level encryption algorithm takes the public key pk and the plaintext m as input, and outputs a first-level ciphertext ct1 corresponding to the plaintext m, wherein the first-level ciphertext ct1 can be re-encrypted into a second-level ciphertext, and the plaintext space ciphertext space

[0024] The step of the first-level encryption specifically comprises:

[0025] randomly selecting s←χ n , wherein χ is a discrete Gaussian distribution on and the output of the first-level ciphertext ct1 corresponding to the plaintext m is:

[0026]

[0027] wherein the formula of the second-level encryption algorithm is: The second-level encryption algorithm takes the public key pk and the plaintext m as input, and outputs a second-level ciphertext ct2 corresponding to the plaintext m, wherein the second-level ciphertext ct2 cannot be re-encrypted, and the plaintext space ciphertext space

[0028] The step of the secondary encryption specifically comprises:

[0029] Splicing the public parameter and A to obtain

[0030]

[0031] Randomly select s←χ n , where χ is a discrete Gaussian distribution on , and the output of the secondary ciphertext ct2 corresponding to the plaintext m is:

[0032]

[0033] wherein the formula of the proxy key generation algorithm is:

[0034] rk 1→2 ←ReKeyGen(pk (1) =(A (1) , A ′ (1) ),sk (1) =(T (1) ,K (1) ),pk (2) =(A (2) ,A′ (2) )),

[0035] The proxy key generation algorithm takes the public and private keys pk (1) ,sk (1) of the principal and the public key pk (2) of the principal as input, and generates the proxy key rk 1→2 from the principal to the principal;

[0036] The step of the proxy key generation specifically comprises:

[0037] Splicing the public parameter and A ′ (2) to obtain

[0038]

[0039] Randomly select Call the original image generation algorithm SamplePre to calculate R; wherein the formula of the original image generation algorithm SamplePre is: wherein the dimension of the R matrix is I is a unit matrix of dimension rk 1→2 = R, and outputs the proxy key rk 1→2 ;

[0040] wherein the re-encryption algorithm is represented by the formula: The re-encryption algorithm takes as input the proxy key rk 1→2 from the principal to the delegate and the first-level ciphertext facing the principal, and outputs the second-level ciphertext facing the delegate which cannot be re-encrypted again;

[0041] The steps of the proxy re-encryption specifically include:

[0042] According to the input R, obtain the matrix with dimension

[0043] According to the formula calculate and output the second-level ciphertext facing the delegate

[0044] wherein the first-level ciphertext decryption algorithm is represented by the formula: m <- Dec1(sk = (T, K), ct1), which takes as input the first-level ciphertext ct1 and the corresponding private key sk, and outputs the plaintext m corresponding to the first-level ciphertext ct1, and divides the first-level ciphertext ct1 into two parts:

[0045] wherein

[0046] The steps of the first-level ciphertext decryption specifically include:

[0047] Call the fault-tolerant learning inversion algorithm to obtain (s, e) by inverting the LWE instance composed of the upper half ciphertext with the trapdoor T, and the formula of the fault-tolerant learning inversion algorithm is represented by:

[0048] Calculate

[0049] For each component of determine whether is true; if so, set the i-th component of the plaintext m i := 1, otherwise set the i-th component of the plaintext m i := 0, and output the plaintext m.

[0050] The formula of the secondary ciphertext decryption algorithm is m <- Dec2 (sk = (T, K), ct2), the secondary ciphertext decryption algorithm takes the secondary ciphertext ct2 and the corresponding private key sk as input, and outputs the plaintext m corresponding to the secondary ciphertext ct2.

[0051] The secondary ciphertext decryption step specifically comprises:

[0052] The matrix K in the private key is concatenated with the unit matrix to obtain The calculation is as follows:

[0053]

[0054] For each component of It is determined whether the following condition is met: If yes, m is set to 1, otherwise m is set to 0, and the plaintext m is output. i i

[0055] In another preferred embodiment, the secondary ciphertext includes a secondary ciphertext generated by secondary encryption and a secondary ciphertext generated by proxy re-encryption.

[0056] In another preferred embodiment, in the step of proxy key generation, the public key and the private key of the principal and the public key of the delegatee are input into a proxy key generation algorithm to generate a proxy key from the principal to the delegatee.

[0057] The embodiment of the application also discloses a ciphertext hierarchical single-hop proxy re-encryption method for a fine-grained proxy function set, comprising the following steps:

[0058] Key generation, inputting a security parameter into a key generation algorithm to generate a pair of public and private keys;

[0059] Primary encryption, inputting the public key and the plaintext into a primary encryption algorithm to generate a primary ciphertext corresponding to the plaintext;

[0060] Secondary encryption, inputting the public key and the plaintext into a secondary encryption algorithm to generate a secondary ciphertext corresponding to the plaintext;

[0061] Fine-grained proxy key generation, inputting the public key and the private key of the principal, the public key of the delegatee and a fine-grained proxy function into a fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the delegatee;

[0062] Proxy re-encryption, inputting the primary ciphertext for the principal and the fine-grained proxy key into a re-encryption algorithm to generate a secondary ciphertext for the delegatee;

[0063] ​​​First-level ciphertext decryption, inputting the first-level ciphertext and the corresponding private key into a first-level ciphertext decryption algorithm to obtain the plaintext corresponding to the first-level ciphertext;

[0064] Second-level ciphertext decryption, inputting the second-level ciphertext and the corresponding private key into a second-level ciphertext decryption algorithm to obtain the plaintext corresponding to the second-level ciphertext;

[0065] Wherein, the first-level ciphertext can be re-encrypted into a second-level ciphertext, and the second-level ciphertext cannot be re-encrypted again.

[0066] In another preferred example, the fine-grained proxy function is an information deletion proxy function f pos ;

[0067] The ciphertext hierarchical single-hop proxy re-encryption method oriented to the fine-grained proxy function set specifically includes:

[0068] Let the plaintext space be The ciphertext space be Where 0, 1 represents normal information bits, and * represents invalid information bits, and the function family is defined as For any input The information deletion proxy function f pos is defined as

[0069]

[0070] That is, when i is in pos, m i ': = *; otherwise, m i ': = m i ; The above function set is an information deletion proxy function set, and the information bits in the subscript set pos will be deleted, that is, set to invalid information bits;

[0071] Wherein, the formula of the key generation algorithm is (sk, pk) <- fgKeyGen (1 λ ), and the key generation algorithm takes the security parameter 1 λ as input to generate a public-private key pair (sk, pk);

[0072] The key generation step specifically includes:

[0073] Calling a trapdoor generation algorithm TrapGen to generate a matrix And a trapdoor T; wherein, the formula of the trapdoor generation algorithm TrapGen is: Wherein, the trapdoor generation algorithm takes parameters n and q as input, Satisfies q >= 2, Represents a set of natural numbers, where T is a small norm matrix with dimensions N x N, representing an integer set, representing a set of residue classes of an integer set modulo q;

[0074] randomly generating matrix splicing obtains:

[0075]

[0076] randomly selecting randomly selecting a public parameter calculating

[0077] set the public key as pk=(A, A ′), set the private key as sk=(T,K), and output the public and private key pair (sk,pk);

[0078] wherein the formula of the first-level encryption algorithm is: The first-level encryption algorithm takes the public key pk and the plaintext m as input, and outputs the first-level ciphertext ct1 corresponding to the plaintext m, which can be re-encrypted into a second-level ciphertext;

[0079] The step of the first-level encryption specifically includes:

[0080] encoding the plaintext m, wherein the formula of the encoding algorithm is: m E ←Encode(m), which takes the plaintext m as input and outputs the encoded value m E ;

[0081] The step of the encoding specifically includes:

[0082] taking as input, and outputting the encoded value for the 2i-1 and 2i bits of m E , wherein has the following encoding rules:

[0083]

[0084] output

[0085] randomly selecting s←χ n , where χ is a discrete Gaussian distribution on , and the output of the first-level ciphertext ct1 corresponding to the plaintext m is:

[0086]

[0087] wherein the formula of the second-level encryption algorithm is: The second-level encryption algorithm takes the public key pk and the plaintext m as input, and outputs the second-level ciphertext ct2 corresponding to the plaintext m, which cannot be re-encrypted again;

[0088] The second-level encryption step specifically includes:

[0089] Encode the plaintext m, where the formula of the encoding algorithm is: m E ←Encode(m), which takes the plaintext m as input and outputs the encoded value m E ;

[0090] Concatenate the public parameters and A ′ to obtain:

[0091]

[0092] Randomly select s←χ n , where χ is a discrete Gaussian distribution on , and the output of the second-level ciphertext ct2 corresponding to the plaintext m is:

[0093]

[0094] where the formula of the fine-grained proxy key generation algorithm is:

[0095] The fine-grained proxy key generation algorithm takes the public and private keys pk (1) , sk (1) of the principal and the public key pk (2) of the principal and the information deletion proxy function f pos as input, and outputs the fine-grained proxy key

[0096] The steps of the fine-grained proxy key generation specifically include:

[0097] According to the f pos function, set the matrix For and , the setting rules are as follows:

[0098]

[0099] Except for the above positions, other positions of I pos are set to 0;

[0100] Concatenate the public parameters and A ′(2) The splicing is performed to obtain:

[0101]

[0102] Randomly select Call the original image generation algorithm SamplePre to calculate R; wherein the formula of the original image generation algorithm SamplePre is as follows:

[0103]

[0104] The dimension of the R matrix is Output the fine-grained proxy key

[0105] The formula of the re-encryption algorithm is as follows: The re-encryption algorithm takes the fine-grained proxy key from the principal to the principal as input, and outputs the second-level ciphertext for the principal The formula of the re-encryption algorithm is as follows: The formula of the re-encryption algorithm is as follows: The second-level ciphertext cannot be re-encrypted again;

[0106] The steps of the proxy re-encryption specifically include:

[0107] Calculate and output the second-level ciphertext for the principal

[0108] The formula of the first-level ciphertext decryption algorithm is as follows: m <- fgDec1(sk = (T, K), ct1), the first-level ciphertext decryption algorithm takes the first-level ciphertext ct1 and the corresponding private key sk as input, and outputs the plaintext m, and the first-level ciphertext ct1 is divided into two parts:

[0109] Wherein

[0110] The steps of the first-level ciphertext decryption specifically include:

[0111] Call the fault-tolerant learning inverse algorithm to inverse the LWE instance composed of the upper half ciphertext with the trapdoor T to obtain (s, e), and the formula of the fault-tolerant learning inverse algorithm is as follows:

[0112] Calculate

[0113] For each component of determine whether is true; if so, set the i-th component of m'i : = 1, otherwise m i : = 0.

[0114] decode m' and output m <- Decode(m'), where the formula of the decoding algorithm is m D <- Decode(m E ), which takes the encoded value m E as input and outputs the decoded value m D .

[0115] The decoding step specifically includes:

[0116] taking as input and outputting the decoded value For the jth component of m D , there is a mapping relationship as follows:

[0117]

[0118] Output

[0119] where the formula of the two-level ciphertext decryption algorithm is m <- fgDec2(sk = (T, K), ct2), which takes the two-level ciphertext ct2 and the corresponding private key sk as input and outputs the plaintext m;

[0120] The two-level ciphertext decryption step specifically includes:

[0121] Concatenate the matrix K in the private key and the identity matrix to obtain

[0122] Calculate:

[0123]

[0124] For each component of , determine whether is true; if so, set the ith component of m' i : = 1, otherwise m i : = 0.

[0125] decode m' and output m <- Decode(m').

[0126] In another preferred example, the fine-grained proxy function is a linear proxy function f M .

[0127] The ciphertext hierarchical single-hop proxy re-encryption method oriented to the fine-grained proxy function set specifically includes:

[0128] Select parameter p, meet q=p 2 ; Let the plaintext space If the infinite norm of the plaintext is small, perform fine-grained proxy re-encryption on it; if the infinite norm of the plaintext is not more than Δ, define a linear proxy function set As follows:

[0129]

[0130] The plaintext space The ciphertext space is

[0131] Wherein, the formula of the key generation algorithm is: (sk, pk) <- fgKeyGen (1 λ ), the key generation algorithm takes the security parameter 1 λ As input, and outputs a public-private key pair (sk, pk);

[0132] The key generation step specifically includes:

[0133] Call the trapdoor generation algorithm TrapGen to generate matrix And trapdoor T; the formula of the trapdoor generation algorithm TrapGen is Wherein the trapdoor generation algorithm takes parameters n, q as input, Meet q >= 2, Represent a set of natural numbers, where T is a small norm matrix with dimension N*N, Represent an integer set, Represent the remainder class set of the integer set modulo q;

[0134] Randomly generate Matrix splicing gets:

[0135]

[0136] Randomly select Randomly select public parameters Calculate

[0137] Set the public key as pk=(A, A '), set the private key as sk=(T, K), and output the public-private key pair (sk, pk);

[0138] Wherein, the formula of the first-level encryption algorithm is: The first-level encryption algorithm takes the public key pk and the plaintext m as input, and outputs the first-level ciphertext ct1 corresponding to the plaintext m, which can be re-encrypted into a second-level ciphertext;

[0139] The step of the first encryption specifically includes:

[0140] Randomly select s←χ n , Where χ is a discrete Gaussian distribution on The first ciphertext corresponding to the plaintext m is output as:

[0141]

[0142] The formula of the second encryption algorithm is: The second encryption algorithm takes the public key pk and the plaintext m as input, and outputs the second ciphertext ct2 corresponding to the plaintext m, which cannot be re-encrypted;

[0143] The step of the second encryption specifically includes:

[0144] The public parameter is spliced with A ' to obtain:

[0145]

[0146] Randomly select s←χ n , Where χ is a discrete Gaussian distribution on The second ciphertext corresponding to the plaintext m is output as:

[0147]

[0148] The formula of the fine-grained proxy key generation algorithm is:

[0149] The fine-grained proxy key generation algorithm takes the public and private keys pk (1) , sk (1) of the principal and the public key pk (2) of the principal and the linear proxy function f M as input, and generates the fine-grained proxy key

[0150] The step of the fine-grained proxy key generation specifically includes:

[0151] The public parameter is spliced with A ' (2) to obtain:

[0152]

[0153] Random selection Call the preimage generation algorithm SamplePre to calculate R, and then f M Using the matrix as input embedding, the formula for the preimage generation algorithm SamplePre is expressed as:

[0154]

[0155] The dimension of the R matrix is set up Its dimensions are

[0156] The formula for the re-encryption algorithm is expressed as follows: This re-encryption algorithm uses a fine-grained proxy key from the principal to the agent. And the first-level encrypted message to the client The input is a secondary encrypted message directed to the agent. The secondary encrypted message It cannot be re-encrypted;

[0157] The proxy re-encryption steps specifically include:

[0158] calculate It also outputs a secondary encrypted message to the entrusted party.

[0159] The formula for the first-level ciphertext decryption algorithm is: m←fgDec1(sk=(T,K),ct1). This first-level ciphertext decryption algorithm takes the first-level ciphertext ct1 and the corresponding private key sk as input and outputs plaintext m, dividing the first-level ciphertext ct1 into two parts:

[0160] in

[0161] The specific steps for decrypting the first-level ciphertext include:

[0162] The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows:

[0163] calculate

[0164] for Each component judge Is it true? If so, then set the i-th component of m. otherwise and output m;

[0165] wherein the formula of the second-level ciphertext decryption algorithm is m <- fgDec2(sk=(T,K),ct2), the second-level ciphertext decryption algorithm takes the second-level ciphertext ct2 and the corresponding private key sk as input, and outputs the plaintext m;

[0166] The step of second-level ciphertext decryption specifically comprises:

[0167] The matrix K in the private key is concatenated with the unit matrix to obtain Calculate:

[0168]

[0169] For each component of Determine whether is true; if so, set the i-th component of m Otherwise and output m.

[0170] In another preferred example, the second-level ciphertext includes a second-level ciphertext generated by second-level encryption and a second-level ciphertext generated by proxy re-encryption.

[0171] In another preferred example, in the step of fine-grained proxy key generation, further comprising: inputting the public and private keys of the principal, the public and private keys of the principal and the fine-grained proxy function into a fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the principal.

[0172] Compared with the prior art, the main difference and effect of the embodiments of the present application are:

[0173] A new ciphertext hierarchical single-hop proxy re-encryption method with post-quantum security and encrypted multi-bit plaintext is provided, which has higher security, higher encryption efficiency, can realize fine-grained ciphertext decryption authorization, and can enable users to freely choose whether the ciphertext can be re-encrypted, thereby being able to block further ciphertext conversion.

[0174] ​A large number of technical features are described in the specification of the present application, which are distributed in various technical solutions. If all possible combinations of technical features (i.e. technical solutions) of the present application are listed, the specification will be too long. In order to avoid this problem, each technical feature disclosed in the above summary of the present application, each technical feature disclosed in the following various embodiments and examples, and each technical feature disclosed in the drawings can be freely combined with each other to form various new technical solutions (which are considered to have been described in the specification), unless such combination of technical features is technically infeasible. For example, features A+B+C are disclosed in one example, features A+B+D+E are disclosed in another example, features C and D are equivalent technical means that play the same role, and can only be used at a time, and feature E can be combined with feature C in terms of technology. Therefore, the solution of A+B+C+D should not be considered to have been described because it is technically infeasible, and the solution of A+B+C+E should be considered to have been described. BRIEF DESCRIPTION OF DRAWINGS

[0175] Figure 1 is a flowchart of a ciphertext hierarchical single-hop proxy re-encryption method according to the first embodiment of the present application;

[0176] Figure 2 is a flowchart of a ciphertext hierarchical single-hop proxy re-encryption method for a fine-grained proxy function set according to the second embodiment of the present application. DETAILED DESCRIPTION

[0177] In the following description, many technical details are presented in order to make the reader better understand the present application. However, it can be understood by those skilled in the art that the technical solutions claimed by the claims of the present application can be implemented even without these technical details and based on various changes and modifications of the following embodiments.

[0178] Explanation of some concepts:

[0179] I. Explanation of mathematical symbols:

[0180] If x is defined by y or the value of y is assigned to x, we write x:=y. For Definition [μ]:={1,2,…,μ}, [a,b]:={a,a+1,…,b}. We use to denote that x is uniformly randomly chosen from the set If is a distribution, denotes the result of sampling x from . We use to define the random variable y output by the algorithm when x is input; if is deterministic, and we write We use to denote that y lies in the support set of. We denote matrices by bold capital letters, such as A, A i,j denotes the element in the i-th row and j-th column of matrix A; bold lowercase letters denote column vectors, such as a, a i denotes the i-th element of vector a. We use ||x|| to denote the 1-norm of x, ||x||2 to denote the 2-norm of x, and ||x|| ∞ to denote the infinity norm of x.

[0181] represents the set of natural numbers, represents the set of real numbers, represents the set of integers, represents the set of residue classes of the set of integers modulo q.

[0182] II. Related terms of lattices:

[0183] Let An m-dimensional lattice is a discrete additive subgroup of the m-dimensional real space . Given k (k ≤ m) linearly independent vectors on, set the matrix Define the lattice generated by A <00​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​For a countable set, define The above uses s as a parameter and a vector. Discrete Gaussian distribution centered at For any

[0189]

[0190] If s = 1, we will abbreviated as If c = 0, we will abbreviated as

[0191] In this application, we use χ to represent a bounded discrete Gaussian distribution, and its bound is represented by B. Therefore, the range of values ​​for χ is [-B, B].

[0192] 2. Trapdoor Generation Algorithm

[0193] The algorithm is denoted by TrapGen, and its inputs are parameters n, m, and q, where... The output is a matrix that satisfies q≥2 and m=O(nlogq). and trapdoor The formula is expressed as (A,T) A )←TrapGen(1 n ,1 m ,q).

[0194] Wherein, the distribution of matrix A is... A uniform distribution on the matrix T is statistically close to the matrix T. A A q-ary orthogonal lattice defined by A A set of short lattice bases (abbreviated as T) A (It is a trapdoor of A) that satisfies T A A = 0 and

[0195] 3. Preimage Sampling Algorithm

[0196] The algorithm is denoted by SamplePre, and its input is a matrix. Trapdoor parameter and arbitrary vectors Output is the preimage Make The formula is expressed as x←SamplePre(A,T) A ,u,γ).

[0197] in And it satisfies q≥2. Furthermore, the preimage x follows a distribution. The algorithm can extend u in the input to a matrix U, and run the pre-image sampling column by column, which can get the output matrix X.

[0198] 4. Difficulty of learning with error

[0199] Let χ be a discrete Gaussian distribution over The difficulty of learning with error (LWE) means that for any polynomial-time adversary Given a matrix A, it cannot distinguish As+emodq (also known as an LWE instance) from a uniformly random value u, where e←χ m ,

[0200] 5. Learning with error inversion algorithm

[0201] The algorithm is denoted as lnvert, which takes as input a trapdoor T A and an LWE instance As+e corresponding to the A matrix, and outputs the corresponding (s, e) in the instance. The formula is (s, e)←lnvert(T A , As+e).

[0202] III. Related terms of proxy re-encryption:

[0203] The related terms in the description of the proxy re-encryption scenario and scheme are as follows:

[0204] 1. Plain text, refers to information that has not been processed by encryption algorithm, usually in the form of data, natural language, etc.

[0205] 2. Key, refers to the secret information needed in the process of encryption and decryption algorithm. In public key encryption scheme, the key is usually divided into public key (public key for short) and private key (private key for short).

[0206] 3. Cipher text, refers to the information that cannot be directly read and recognized after the plain text is converted by the encryption algorithm.

[0207] 4. Cipher text for user A, refers to the cipher text sent to user A and intended to be decrypted using user A's private key.

[0208] 5. Delegator, refers to the role in the proxy re-encryption scenario who wants to delegate his decryption right to other users.

[0209] 6. Proxy, refers to the role in the proxy re-encryption scenario who helps the delegator to complete the delegation of decryption right.

[0210] 7. The delegate (Delegetee) refers to the role that receives the decryption right in a proxy re-encryption scenario.

[0211] 8. Proxy key: In a proxy re-encryption scenario, this refers to the secret information held by the proxy. It is usually related to the key information of both the principal and the proxy, and its function is to assist the proxy in delegating the decryption authority.

[0212] 9. Plaintext space refers to the set to which the plaintext belongs, expressed in terms of... To express.

[0213] 10. Cipherspace refers to the set to which the ciphertext belongs, expressed in words such as ciphertext space. To express.

[0214] 11. A set of fine-grained surrogate functions refers to a collection of a specific type of function. This is used to represent the domain and range of this type of function. A subset of, a function within the set Function in plaintext The function value f(m) is obtained from this, which can be regarded as a fine-grained operation on m. Here, both m and f(m) are considered as plaintext.

[0215] The following is a brief summary of some of the innovative aspects of this application:

[0216] I. Ciphertext Hierarchical Single-hop Proxy Re-encryption Scheme:

[0217] Let set These are the plaintext space and the ciphertext space, respectively. The proxy re-encryption scheme includes seven algorithms PRE = (KeyGen, ReKeyGen, Enc1, Enc2, ReEnc, Dec1, Dec2), defined as follows:

[0218] 1. The key generation algorithm is denoted by KeyGen. Its input is the security parameter λ, and its output is a public-private key pair (pk) for user i. i ,sk i The formula is expressed as (pk) i ,sk i )←KeyGen(1 λ ).

[0219] 2. The proxy key generation algorithm is represented by ReKeyGen, and its input is the public and private keys (pk) of the principal i. i ,sk i ) and the public and private keys (pk) of the entrusted person j j ,sk j The output is the proxy key rk from i to j.i→j .

[0220] The formula is represented as rk i→j ← ReKeyGen(pk i , sk i , pk j , sk j ).

[0221] When considering the non-interactive proxy re-encryption scheme, the algorithm does not need to input sk j .

[0222] The formula is represented as rk i→j ← ReKeyGen(pk i , sk i , pk j ).

[0223] 3. The first-level encryption algorithm is denoted by Enc1, which takes as input the user public key pk i and the plaintext message and outputs the first-level ciphertext for user i The first-level ciphertext supports re-encryption operation, which is converted into the second-level ciphertext. The formula of the first-level encryption algorithm is represented as c i ← Enc1(pk i , m).

[0224] 4. The second-level encryption algorithm is denoted by Enc2, which takes as input the user public key pk i and the plaintext message and outputs the second-level ciphertext for user i The second-level ciphertext does not support re-encryption operation. The formula of the second-level encryption algorithm is represented as c i ← Enc2(pk i , m).

[0225] 5. The re-encryption algorithm is denoted by ReEnc, which takes as input the proxy key rk i→j and the first-level ciphertext for user i c i and outputs the re-encrypted ciphertext for user j or the failure symbol ⊥.

[0226] The formula is represented as c j / ⊥ ← ReEnc(c i , rk i→j ).

[0227] 6. The first-level ciphertext decryption algorithm is denoted by Dec1, which takes as input the decryption key sk i and the first-level ciphertext c i and outputs or the failure symbol ⊥, and the formula is represented as m / ⊥ ← Dec1(ski i

[0228] 7. The second-level ciphertext decryption algorithm is denoted as Dec2, the input is the decryption key sk i and the second-level ciphertext c i , and the output is or the failure symbol ⊥, and the formula is expressed as m / ⊥←Dec2(sk i ,c i ).

[0229] The correctness of the proxy re-encryption scheme PRE refers to that for any (pk i ,sk i )←KeyGen(1 λ ), (pk j ,sk j )←KeyGen(1 λ ), rk i→j ←ReKeyGen(pk i ,sk i ,pk j ,sk j ) (if it is a non-interactive proxy, then rk i→j ←ReKeyGen(pk i ,sk i ,pk j )), c i ←Enc1(pk i ,m), c i '←Enc2(pk i ,m') and c j ←ReEnc(c i ,rk i→j ), there are Dec1(sk i ,c i ) = Dec2(sk j ,c j ) = m; Dec2(sk i ,c i ') = m'.

[0230] II. A ciphertext hierarchical single-hop proxy re-encryption scheme oriented to a fine-grained proxy function set :

[0231] The fine-grained proxy re-encryption scheme can realize fine-grained decryption authorization. Fine granularity is embodied by a function set . The conversion key is bound to a function f in the set , denoted as User A aims at the function ​​Generating a conversion key between user A and user B The conversion key is given to the proxy. The proxy party efficiently converts the ciphertext C A oriented to user A into a ciphertext oriented to user B by using the proxy re-encryption algorithm. If C A is the encryption of the plaintext m by the public key of user A, then user D can obtain the function value f(m) of the plaintext m after decrypting the converted ciphertext . Similarly, the conversion key between user A and user B does not leak the private key information of user A and user B. By authorizing different functions in , user A can achieve fine-grained authorization of the decryption right of the ciphertext.

[0232] For example, the principal A only wants the delegatee B to know the result of voting for a certain election. Then, the principal A only needs to generate a conversion key for the accumulation function. When all the votes are encrypted by the public key of the principal A to obtain the ciphertext C A , the proxy can convert the ciphertext C A into by using the conversion key generated for the accumulation function, and give to the delegatee. The delegatee decrypts to obtain the accumulation sum of all the votes, and further obtain the voting result.

[0233] Let the sets be the plaintext space, the ciphertext space, and the set of fine-grained proxy functions, respectively. The fine-grained proxy re-encryption scheme (fgPRE) contains seven algorithms fgPRE=(fgKeyGen,fgReKeyGen,fgEnc1,fgEnc2,fgReEnc,fgDec1,fgDec2), which are defined as follows:

[0234] 1. The key generation algorithm is denoted by fgKeyGen, the input is a security parameter λ, and the output is a pair of public and private keys (pk i ,sk i ) of user i, which is expressed as (pk i ,sk i )←fgKeyGen(1 λ ).

[0235] 2. The fine-grained proxy key generation algorithm is denoted by fgReKeyGen, the input is the public and private keys (pk i ,sk i ) of the principal i, the public and private keys (pk j ,sk j ) of the delegatee j, and the function Generate fine-grained proxy keys from i to j

[0236] The formula is expressed as

[0237] When considering non-interactive, fine-grained proxy re-encryption schemes, the algorithm does not require input sk. j .

[0238] The formula is expressed as

[0239] 3. The first-level encryption algorithm is denoted by fgEnc1, and the input is the public key pk of user i. i and plain text messages Output the first-level ciphertext for user i Level 1 ciphertext can be re-encrypted to convert it into level 2 ciphertext. The formula for the level 1 encryption algorithm is expressed as c. i ←fgEnc1(pk i ,m).

[0240] 4. The two-level encryption algorithm is represented by fgEnc2, and the input is the public key pk of user i. i and plain text messages Output the second-level ciphertext for user i Level 2 ciphertext does not support re-encryption. The formula for the level 2 encryption algorithm is c. i ←fgEnc2(pk i ,m).

[0241] 5. The re-encryption algorithm is denoted by fgReEnc, and its input is a fine-grained proxy key. And the first-level ciphertext c for user i i The output is a re-encrypted ciphertext for user j. Or the failure symbol ⊥.

[0242] The formula is expressed as

[0243] 6. The first-level ciphertext decryption algorithm is represented by fgDec1, and the input is the decryption key sk. i and Level 1 ciphertext c i Output Alternatively, the failure symbol ⊥, represented by the formula m / ⊥←fgDec1(sk i ,c i ).

[0244] 7. The two-level ciphertext decryption algorithm is represented by fgDec2, and the input is the decryption key sk. i and secondary ciphertext c i The output is or a failure symbol ⊥, the formula is expressed as m / ⊥←fgDec2(sk i , i ).

[0245] The correctness of the fine-grained ciphertext hierarchical proxy re-encryption scheme fgPRE means that for any (pk i ,sk i )←KeyGen(1 λ ), (pk j ,sk j )←fgKeyGen(1 λ ), (if it is a non-interactive proxy, then ), c i ←fgEnc1(pk i ,m), c i '←fgEnc2(pk i ,m') and the following formula is established:

[0246] fgDec1(sk i ,c i ) = m, fgDec2(sk i ,c i ') = m', fgDec2(sk j ,c j ) = f(m).

[0247] It should be noted that those skilled in the art can understand that in each embodiment of the present application, the above-mentioned plaintext message m and fine-grained proxy function f(m) are both a kind of plaintext.

[0248] When the fine-grained proxy function f takes the identity function, the scheme degenerates into a conventional proxy re-encryption scheme.

[0249] Three, the properties of proxy re-encryption:

[0250] 1. Single-hop proxy re-encryption.

[0251] In a proxy re-encryption scheme PRE, if a ciphertext for a user can be re-encrypted to a new ciphertext for another user by proxy re-encryption, and the new ciphertext cannot be re-encrypted to a ciphertext for a third user by proxy re-encryption, then the proxy re-encryption scheme has the property of single-hop proxy re-encryption. For example, a ciphertext for user A can be re-encrypted to a ciphertext for user B by proxy re-encryption, but the ciphertext for user B cannot be re-encrypted to a ciphertext for user C by proxy re-encryption. In this case, the proxy re-encryption scheme is single-hop. Conversely, the proxy re-encryption scheme is multi-hop.

[0252] 2. Unidirectional.

[0253] In a proxy re-encryption scheme PRE, if the proxy key from user i to user j is rk i→j , then using the proxy key, the re-encryption algorithm can only re-encrypt a decryptable ciphertext for user i to a decryptable ciphertext for user j, but cannot re-encrypt a decryptable ciphertext for user j to a decryptable ciphertext for user i. This property is the unidirectional property of the proxy re-encryption scheme.

[0254] 3. Non-interactive.

[0255] In a proxy re-encryption scheme PRE, if the proxy key from user i to user j is rk i→j , and the proxy key can be independently generated by user i without the participation of a proxy and without interaction with user j, then the proxy re-encryption scheme is non-interactive.

[0256] 4. Unlinkable.

[0257] In a proxy re-encryption scheme PRE, given a sequence of ciphertexts on a multi-hop proxy chain (such as ct1→ct2→ct3→…→ct n , where ct i →ct i+1 indicates that the ciphertext ct i is re-encrypted to ct i→i+1 under the action of the proxy key rk i+1 ), and a sequence of ciphertexts independently generated by the encryption algorithm ({t i ′} i∈[n] ), an adversary cannot distinguish between the two sequences. Such a proxy re-encryption scheme has the property of unlinkability.

[0258] 5. Collusion-resistant security.

[0259] In a proxy re-encryption scheme PRE, if the proxy and user j cannot obtain the private key of user i by collusion, i.e., given skj , rk i→j Compute sk i Then the proxy re-encryption scheme is collusion safe.

[0260] 6. Semantic Security.

[0261] A proxy re-encryption scheme PRE is said to be semantically secure if, for any probabilistic polynomial-time adversary, it is infeasible to distinguish between ciphertexts that are encryptions of messages and where the adversary can make key generation queries, private key extraction queries, proxy key generation queries.

[0262] In order to make the purposes, technical solutions and advantages of the present application clearer, the following will further describe the embodiments of the present application with reference to the accompanying drawings.

[0263] The first embodiment of the present application relates to a ciphertext hierarchical single-hop proxy re-encryption method. Figure 1 is a flowchart of the ciphertext hierarchical single-hop proxy re-encryption method.

[0264] The plaintext space of the ciphertext hierarchical single-hop proxy re-encryption scheme PRE=(KeyGen, ReKeyGen, Enc1, Enc2, ReEnc, Dec1, Dec2) is The ciphertext space is

[0265] Specifically, as shown in Figure 1 , the ciphertext hierarchical single-hop proxy re-encryption method comprises the following steps.

[0266] In step 101, key generation, a pair of public and private keys is generated by inputting a security parameter into a key generation algorithm.

[0267] Thereafter, step 102, first-level encryption, is entered, in which a public key and a plaintext are input into a first-level encryption algorithm to generate a first-level ciphertext corresponding to the plaintext.

[0268] Thereafter, step 103, second-level encryption, is entered, in which a public key and a plaintext are input into a second-level encryption algorithm to generate a second-level ciphertext corresponding to the plaintext.

[0269] Thereafter, step 104, proxy key generation, is entered, in which a principal's public and private keys and a delegatee's public key are input into a proxy key generation algorithm to generate a principal-to-delegatee proxy key.

[0270] It should be noted that there is no priority between step 102, step 103 and step 104. The present embodiment is only a preferred embodiment, and is not limited thereto.

[0271] Then proceed to step 105, the agent re-encrypts, inputting the first-level ciphertext for the principal and the agent key into the re-encryption algorithm to generate the second-level ciphertext for the agent.

[0272] Then proceed to step 106, decrypting the first-level ciphertext. Input the first-level ciphertext and the corresponding private key into the first-level ciphertext decryption algorithm to obtain the plaintext corresponding to the first-level ciphertext.

[0273] Then proceed to step 107, decrypting the secondary ciphertext, by inputting the secondary ciphertext and the corresponding private key into the secondary ciphertext decryption algorithm to obtain the plaintext corresponding to the secondary ciphertext;

[0274] The first-level ciphertext can be re-encrypted into second-level ciphertext, but the second-level ciphertext cannot be re-encrypted.

[0275] It should be noted that there is no sequential order between steps 106 and 107. This embodiment is only a preferred embodiment and is not limited thereto.

[0276] This process will then end.

[0277] In this embodiment, preferably,

[0278] Also includes: System settings algorithm: pp←Setup(1 λ The system's algorithm takes a safety parameter λ as input and outputs a safety parameter pp. The algorithm randomly selects... Output As a public parameter. The public parameter pp is the input for each subsequent algorithm, and for simplicity, it will not be explicitly written out.

[0279] In step 101 above, the formula for the key generation algorithm is expressed as: (sk,pk)←KeyGen(1 λ The key generation algorithm uses security parameter 1. λ Given the input, generate a public-private key pair (sk, pk).

[0280] Furthermore, step 101 specifically includes the following sub-steps:

[0281] The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. representing an integer set, representing a set of residue classes of integer sets modulo q;

[0282] randomly generating by matrix splicing:

[0283]

[0284] randomly selecting randomly selecting public parameters calculating

[0285] set the public key as pk=(A, A ′), set the private key as sk=(T,K), and output the public-private key pair (sk,pk).

[0286] In the above step 102, the formula of the first-level encryption algorithm is represented as: The first-level encryption algorithm takes the public key pk and the plaintext m as input, and outputs the first-level ciphertext ct1 corresponding to the plaintext m, wherein the first-level ciphertext ct1 can be re-encrypted into a second-level ciphertext, the plaintext space ciphertext space

[0287] Further, the step 102 specifically includes the following sub-steps:

[0288] randomly select s←χ n , where χ is a discrete Gaussian distribution on , and the first-level ciphertext ct1 corresponding to the plaintext m is output as:

[0289]

[0290] In the above step 103, the formula of the second-level encryption algorithm is represented as: The second-level encryption algorithm takes the public key pk and the plaintext m as input, and outputs the second-level ciphertext ct2 corresponding to the plaintext m, wherein the second-level ciphertext ct2 cannot be re-encrypted, the plaintext space ciphertext space

[0291] Further, the step 103 specifically includes the following sub-steps:

[0292] splice the public parameters and A ′ to obtain:

[0293]

[0294] Randomly select s←χ n , where χ is a discrete Gaussian distribution on , the output of the second-level ciphertext ct2 corresponding to the plaintext m is:

[0295]

[0296] In the above step 104, the formula of the proxy key generation algorithm is:

[0297] rk 1→2 ←ReKeyGen(pk (1) =(A (1) , A ′ (1) ),sk (1) =(T (1) ,K (1) ),pk (2) =(A (2) , A ′ (2) )),

[0298] The proxy key generation algorithm takes the public and private keys pk (1) ,sk (1) of the principal and the public key pk (2) of the principal as input, and generates the proxy key rk 1→2 from the principal to the principal.

[0299] It should be noted that the above proxy key generation algorithm is a non-interactive proxy key generation algorithm.

[0300] Further, the step 104 specifically includes the following sub-steps:

[0301] Splice the public parameters and A ′ (2) to obtain:

[0302]

[0303] Randomly select Call the original image generation algorithm SamplePre to calculate R; wherein the formula of the original image generation algorithm SamplePre is: where the dimension of the R matrix is I is a unit matrix of dimension, set rk 1→2 =R, and output the proxy key rk 1→2 .

[0304] In step 105, the re-encryption algorithm is represented by the formula: The re-encryption algorithm takes as input the principal-to- delegate proxy key rk 1→2 and the principal-oriented first ciphertext and outputs the delegate-oriented second ciphertext The second ciphertext cannot be re-encrypted.

[0305] Further, step 105 specifically includes the following sub-steps:

[0306] According to the input R, the matrix is obtained, which has a dimension of

[0307] According to the formula the delegate-oriented second ciphertext is calculated and output.

[0308] In step 106, the first ciphertext decryption algorithm is represented by the formula: m <- Dec1(sk = (T, K), ct1), which takes as input the first ciphertext ct1 and the corresponding private key sk, and outputs the plaintext m corresponding to the first ciphertext ct1. The first ciphertext ct1 is divided into two parts:

[0309] wherein

[0310] Further, step 106 specifically includes the following sub-steps:

[0311] The fault-tolerant learning inversion algorithm is called to obtain (s, e) by inverting the LWE instance composed of the upper half ciphertext with the trapdoor T. The formula of the fault-tolerant learning inversion algorithm is:

[0312] Calculate

[0313] For each component of , determine whether is true; if so, set the i-th component of m i to 1, otherwise set the i-th component of m i to 0, and output the plaintext m.

[0314] In step 107, the second ciphertext decryption algorithm is represented by the formula: m <- Dec2(sk = (T, K), ct2), which takes as input the second ciphertext ct2 and the corresponding private key sk, and outputs the plaintext m corresponding to the second ciphertext ct2.

[0315] Further, the step 107 specifically comprises the following sub-steps:

[0316] The matrix K in the private key is concatenated with the unit matrix to obtain Calculate:

[0317]

[0318] For each component of Determine whether is true; if yes, set m i : = 1, otherwise m i : = 0, and output the plaintext m.

[0319] The correctness of the ciphertext hierarchical single-hop proxy re-encryption method described above is demonstrated as follows:

[0320] 1. Basic encryption and decryption correctness of the first-level ciphertext:

[0321] If the ciphertext ct1 is the output of the first-level encryption algorithm (step 102), it can be considered as:

[0322]

[0323] The upper half is a fault-tolerant learning instance of , which is solved by T to obtain Calculate Let be the upper bound of the discrete Gaussian χ. Obviously, the above decryption method can correctly decrypt and recover m.

[0324] 2. Basic encryption and decryption correctness of the second-level ciphertext:

[0325] For the ciphertext ct2 obtained by the second-level encryption algorithm (step 103), it can be considered as:

[0326]

[0327] Note that Therefore:

[0328]

[0329] The absolute value of each component of the noise terms e1, e2 in ct2 does not exceed B, and since When , the above decryption method can correctly decrypt and recover m.

[0330] 3. Encryption and decryption correctness of the re-encrypted ciphertext:

[0331] ​For the ciphertext obtained by the first-level encryption algorithm (step 102) Single re-encryption (step 105) is performed on it, and the obtained ciphertext is:

[0332]

[0333] Since therefore Therefore, we have:

[0334]

[0335] As can be seen, the re-encrypted ciphertext is consistent with the format of the ciphertext obtained by the second-level encryption. Since the matrix R is generated by the TrapGen algorithm, its norm does not exceed B; since is a first-level ciphertext, the norm of the noise e1, e2 it contains does not exceed B. For each dimension component e' of the new noise B', we have |e'| ≤ (nB + NB + 1)B, and for each dimension component s' of s', we have |s'| ≤ nBB < |e'|. Combined with the basic encryption and decryption correctness of the second-level ciphertext, when the above decryption algorithm can correctly decrypt and recover m.

[0336] Further, preferably,

[0337] In some embodiments, the second-level ciphertext includes a second-level ciphertext generated by the second-level encryption (step 103) and a second-level ciphertext generated by the proxy re-encryption (step 105).

[0338] In some embodiments, the step 104 further comprises: inputting the principal's public and private keys pk 91) ,sk (1) and the delegatee's public and private keys pk (2) ,sk (2) into a proxy key generation algorithm to generate a principal-to-delegatee proxy key rk 1→2 .

[0339] The second embodiment of the present application relates to a ciphertext hierarchical single-hop proxy re-encryption method for a fine-grained proxy function set. Figure 2 is a flowchart of the ciphertext hierarchical single-hop proxy re-encryption method for a fine-grained proxy function set.

[0340] Specifically, as shown in Figure 2 , the ciphertext hierarchical single-hop proxy re-encryption method for a fine-grained proxy function set comprises the following steps:

[0341] In step 201, key generation, input the security parameter into the key generation algorithm to generate a pair of public and private keys.

[0342] After entering step 202, primary encryption, the public key and the plaintext are input into a primary encryption algorithm to generate primary ciphertext corresponding to the plaintext.

[0343] After entering step 203, secondary encryption, the public key and the plaintext are input into a secondary encryption algorithm to generate secondary ciphertext corresponding to the plaintext.

[0344] After entering step 204, fine-grained proxy key generation, the principal's public and private keys, the delegatee's public key, and the fine-grained proxy function are input into a fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the delegatee.

[0345] It should be noted that there is no priority between step 202, step 203, and step 204. The present embodiment is only a preferred embodiment and is not limited thereto.

[0346] After entering step 205, proxy re-encryption, the primary ciphertext facing the principal and the fine-grained proxy key are input into a re-encryption algorithm to generate secondary ciphertext facing the delegatee.

[0347] After entering step 206, primary ciphertext decryption, the primary ciphertext and the corresponding private key are input into a primary ciphertext decryption algorithm to obtain the plaintext corresponding to the primary ciphertext.

[0348] After entering step 207, secondary ciphertext decryption, the secondary ciphertext and the corresponding private key are input into a secondary ciphertext decryption algorithm to obtain the plaintext corresponding to the secondary ciphertext.

[0349] The primary ciphertext can be re-encrypted into secondary ciphertext, and the secondary ciphertext cannot be re-encrypted again.

[0350] It should be noted that there is also no priority between step 206 and step 207. The present embodiment is only a preferred embodiment and is not limited thereto.

[0351] After entering step 207, the present process ends.

[0352] In one preferred embodiment of the present embodiment, the fine-grained proxy function is an information deletion proxy function f pos The ciphertext hierarchical single-hop proxy re-encryption method facing the set of fine-grained proxy functions is a ciphertext hierarchical single-hop proxy re-encryption method facing a set of information deletion proxy functions f .

[0353] Accordingly, the ciphertext hierarchical single-hop proxy re-encryption method fgPRE = (fgKeyGen, fgReKeyGen, fgEnc1, fgEnc2, fgReEnc, fgDec1, fgDec2) for a fine-grained proxy function set specifically includes:

[0354] Let plain text space Cipherspace Where 0 and 1 represent normal information bits, and * represents invalid information bits, a family of functions is defined. For any input The information deletion proxy function f pos Defined as:

[0355]

[0356] That is, when i∈pos, m i ′:=*; otherwise, m i ′:=m i The above function set is a set of information deletion proxy functions. The information bit with the index located in the set pos will be deleted, that is, set to an invalid information bit.

[0357] In this embodiment, preferably,

[0358] Also includes: System settings algorithm: pp←Setup(1 λ The system's algorithm takes a safety parameter λ as input and outputs a safety parameter pp. The algorithm randomly selects... Output As a public parameter. The public parameter pp is the input for each subsequent algorithm, and for simplicity, it will not be explicitly written out.

[0359] In step 201 above, the formula for the key generation algorithm is expressed as: (sk,pk)←fgkeyGen(1 λ The key generation algorithm uses security parameter 1. λ Given the input, generate a public-private key pair (sk, pk).

[0360] Furthermore, step 201 specifically includes the following sub-steps:

[0361] The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. representing an integer set, representing a set of residue classes of integer sets modulo q;

[0362] randomly generating matrix splicing obtains:

[0363]

[0364] randomly selecting randomly selecting a public parameter calculating

[0365] set the public key as pk=(A, A ′), set the private key as sk=(T,K), and output the public and private key pair (sk,pk).

[0366] In the above step 202, the formula of the first-level encryption algorithm is: The first-level encryption algorithm takes the public key pk and the plaintext m as input, and outputs the first-level ciphertext ct1 corresponding to the plaintext m, which can be re-encrypted into a second-level ciphertext.

[0367] Further, the step 202 specifically includes the following sub-steps:

[0368] Encode the plaintext m, wherein the formula of the encoding algorithm is: m E ←Encode(m), the encoding algorithm takes the plaintext m as input, and outputs the encoded value m E ;

[0369] The step of encoding specifically includes:

[0370] taking as input, and outputting the encoded value for the 2i-1 and 2 bits of m E , wherein has the following encoding rules:

[0371]

[0372] Output

[0373] Randomly select s←χ n , where χ is a discrete Gaussian distribution on , and the output of the first-level ciphertext ct1 corresponding to the plaintext m is:

[0374]

[0375] In step 203, the formula of the secondary encryption algorithm is as follows: The secondary encryption algorithm takes the public key pk and the plaintext m as input, and outputs the secondary ciphertext ct2 corresponding to the plaintext m, which cannot be re-encrypted.

[0376] Further, step 203 specifically includes the following sub-steps:

[0377] Encode the plaintext m, where the formula of the encoding algorithm is as follows: m E ←Encode(m), which takes the plaintext m as input and outputs the encoded value m E ;

[0378] Concatenate the public parameters and A ′ to obtain:

[0379]

[0380] Randomly select s←χ n , where χ is a discrete Gaussian distribution on , and the output of the secondary ciphertext ct2 corresponding to the plaintext m is:

[0381]

[0382] In step 204, the formula of the fine-grained proxy key generation algorithm is as follows:

[0383] The fine-grained proxy key generation algorithm takes the public and private keys pk (1) , sk (1) of the principal and the public key pk (2) of the principal and the information deletion proxy function f pos as input, and outputs the fine-grained proxy key

[0384] It should be noted that the above fine-grained proxy key generation algorithm is a non-interactive proxy key generation algorithm.

[0385] Further, step 204 specifically includes the following sub-steps:

[0386] According to the f pos function, set the matrix For and , the setting rules are as follows:

[0387]

[0388] Other positions of I pos are set to 0;

[0389] The public parameter is concatenated with A ′ (2) to obtain:

[0390]

[0391] Randomly select The original image generation algorithm SamplePre is called to calculate R; wherein the formula of the original image generation algorithm SamplePre is as follows:

[0392]

[0393] Wherein the dimension of the R matrix is The fine-grained proxy key

[0394] In the step 205, the formula of the re-encryption algorithm is as follows: The re-encryption algorithm takes the fine-grained proxy key from the principal to the principal as input, and outputs the second-level ciphertext for the principal The second-level ciphertext cannot be re-encrypted. Further, the step 205 specifically includes the following sub-steps:

[0395] Calculate and output the second-level ciphertext for the principal

[0396] In the step 206, the formula of the first-level ciphertext decryption algorithm is as follows: m←fgDec1(sk=(T,K),ct1), which takes the first-level ciphertext ct1 and the corresponding private key sk as input, and outputs the plaintext m. The first-level ciphertext ct1 is divided into two parts:

[0397] Wherein

[0398] Further, the step 206 specifically includes the following sub-steps:

[0399]

[0400] ​​The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the upper half of the ciphertext is inverted using a trapdoor to obtain (s,e). The formula for the fault-tolerant learning inversion algorithm is expressed as follows:

[0401] calculate

[0402] for Each component judge Is it true? If so, then set the i-th component m′. i ′:=1, otherwise m i ′:=0;

[0403] Decode m′ and output m←Decode(m′); where the decoding algorithm is expressed as: m D ←Decode(m E The decoding algorithm uses the encoded value m E The input is the decoded value m, and the output is the decoded value m. D ;

[0404] The decoding steps specifically include:

[0405] by Input is the decoded value. For m D The j-th component, The following mapping relationship exists:

[0406]

[0407] Output

[0408] In step 207 above, the formula for the secondary ciphertext decryption algorithm is: m←fgDec2(sk=(T,K),ct2). This secondary ciphertext decryption algorithm takes the secondary ciphertext ct2 and the corresponding private key sk as input and outputs the plaintext m.

[0409] Furthermore, step 207 specifically includes the following sub-steps:

[0410] Compare matrix K in the private key with the identity matrix spliced ​​together

[0411] calculate:

[0412]

[0413] for Each component judge whether it is true, if yes, set the i-th component of m' m i ' := 1, otherwise m i ' := 0.

[0414] Decode(m') and output m <- Decode(m').

[0415] The correctness of the ciphertext hierarchical single-hop proxy re-encryption method for the above information deletion-oriented proxy function set is demonstrated as follows:

[0416] 1. The correctness of encoding and decoding:

[0417] According to the above encoding and decoding algorithm, for any , there is:

[0418] Decode(Encode(m)) = m.

[0419] Decode(I pos ×Encode(m)) = f pos (m).

[0420] 2. The basic encryption and decryption correctness of the first-level ciphertext:

[0421] If the first-level ciphertext ct1 is the output of the first-level encryption algorithm (step 202), it can be considered as:

[0422]

[0423] The upper half is a fault-tolerant learning instance of , which is solved by T to get . Let be the upper bound of the discrete Gaussian χ, obviously the above decryption method can correctly decrypt and recover m E . Combined with the correctness of encoding and decoding, the correct m <- Decode(m E ) is obtained.

[0424] 3. The basic encryption and decryption correctness of the second-level ciphertext:

[0425] If the second-level ciphertext ct2 is the output of the second-level encryption algorithm (step 203), it can be considered as:

[0426]

[0427] Note that Therefore:

[0428]

[0429] The absolute value of each component of the noise term e1, e2 in ct2 is not more than B, and since When , the decryption method described above can correctly decrypt and restore m E . Furthermore, m is correctly restored as m ← Decode(m E ).

[0430] 4. Re-encryption decryption correctness:

[0431] For the ciphertext c obtained by the first-level encryption algorithm (step 202) , a single re-encryption (step 205) is performed on it, and the obtained re-encrypted ciphertext (second-level ciphertext) is:

[0432]

[0433] Since , we have Therefore, we have:

[0434]

[0435] It can be seen that the re-encrypted ciphertext is consistent with the format of the ciphertext obtained by the second-level encryption. Since the matrix R is generated by the TrapGen algorithm, its norm is not more than B; since is a first-level ciphertext, the norm of the noise e1, e2 contained in it is not more than B. For each dimension component e' of the new noise e', we have |e'| ≤ (nB + NB + 1)B, and for each dimension component s' of s', we have |s'| ≤ nBB < |e'|. Combined with the basic encryption and decryption correctness of the second-level ciphertext, when , the decryption algorithm described above can correctly decrypt and restore I pos m E , and further obtain f pos (m) ← Decode(I pos m E ).

[0436] In another preferred embodiment of the present embodiment, the fine-grained proxy function is a linear proxy function f M , and the ciphertext hierarchical single-hop proxy re-encryption method oriented to the fine-grained proxy function set is a ciphertext hierarchical single-hop proxy re-encryption method oriented to a linear proxy function set.

[0437] Correspondingly, the ciphertext hierarchical single-hop proxy re-encryption method oriented to the fine-grained proxy function set fgPRE = (fgKeyGen, fgReKeyGen, fgEnc1, fgEnc2, fgReEnc, fgDec1, fgDec2) specifically includes:

[0438] Select a parameter p, satisfying q = p 2 ; let the plaintext space If the infinite norm of the plaintext is small, fine-grained proxy re-encryption is performed on it; if the infinite norm of the plaintext is not more than Δ, define a linear proxy function set As follows:

[0439]

[0440] The plaintext space The ciphertext space is

[0441] It should be noted that if M is a unit matrix, then f M is an identity function, and at this time the scheme degenerates into a conventional (non-fine-grained) proxy re-encryption scheme. At this time, the plaintext space is

[0442] In the present embodiment, preferably,

[0443] Further comprising: a system setting algorithm: pp <- Setup(1 λ ). The system setting algorithm takes a security parameter λ as input and outputs a security parameter pp. The system setting algorithm randomly selects Output as public parameters. The public parameters pp are the input of each subsequent algorithm, and for the sake of simplicity, are not explicitly written out.

[0444] In the above step 201, the formula of the key generation algorithm is: (sk, pk) <- fgKeyGen(1 λ ), which takes a security parameter 1 λ as input and outputs a public-private key pair (sk, pk).

[0445] Further, the step 201 specifically includes the following sub-steps:

[0446] A trapdoor generation algorithm TrapGen is called, and the formula of the trapdoor generation algorithm TrapGen is Where the trapdoor generation algorithm takes parameters n, q as input, satisfying q ≥ 2, represents a set of natural numbers, where T is a small norm matrix with a dimension of N x N, represents a set of integers, represents a set of residue classes modulo q;

[0447] Randomly generate Matrix splicing obtains:

[0448] ​

[0449] randomly selecting randomly selecting a public parameter calculating

[0450] Let the public key be pk = (A, T) and the private key be sk = (s, K), and output the public-private key pair (sk, pk). A

[0451] In the above step 202, the formula of the first-level encryption algorithm is: The first-level encryption algorithm takes the public key pk and the plaintext m as input, and outputs the first-level ciphertext ct1 corresponding to the plaintext m, which can be re-encrypted into a second-level ciphertext.

[0452] Further, the step 202 specifically includes the following sub-steps:

[0453] randomly selecting s <- χ n , where χ is a discrete Gaussian distribution on , and the output of the first-level ciphertext ct1 corresponding to the plaintext m is:

[0454]

[0455] In the above step 203, the formula of the second-level encryption algorithm is: The second-level encryption algorithm takes the public key pk and the plaintext m as input, and outputs the second-level ciphertext ct2 corresponding to the plaintext m, which cannot be re-encrypted.

[0456] Further, the step 203 specifically includes the following sub-steps:

[0457] concatenate the public parameter and A to obtain:

[0458]

[0459] randomly selecting s <- χ n , where χ is a discrete Gaussian distribution on , and the output of the second-level ciphertext ct2 corresponding to the plaintext m is:

[0460]

[0461] In the above step 204, the formula of the fine-grained proxy key generation algorithm is:

[0462] ​ The fine-grained proxy key generation algorithm takes the principal's public-private key pk (1) , sk (1) and the delegate's public key pk (2) as input, and generates the principal-to-delegate fine-grained proxy key M

[0463] It should be noted that the above fine-grained proxy key generation algorithm is a non-interactive proxy key generation algorithm.

[0464] Further, the step 204 specifically includes the following sub-steps:

[0465] Concatenate the public parameters and A ' (2) to obtain:

[0466]

[0467] Randomly select Call the sample pre-image generation algorithm SamplePre to calculate R, taking the matrix of f M as input, and the formula of the sample pre-image generation algorithm SamplePre is as follows:

[0468]

[0469] Where the dimension of the R matrix is Set with a dimension of

[0470] In the above step 205, the formula of the re-encryption algorithm is as follows: The re-encryption algorithm takes the principal-to-delegate fine-grained proxy key and the first-level ciphertext for the principal as input, and outputs the second-level ciphertext for the delegate The second-level ciphertext cannot be re-encrypted.

[0471] Further, the step 205 specifically includes the following sub-steps:

[0472] Calculate and output the second-level ciphertext for the delegate

[0473] ​​In step 206, the formula of the first-level ciphertext decryption algorithm is: m <- fgDec1 (sk = (T, K), ct1), which takes the first-level ciphertext ct1 and the corresponding private key sk as input and outputs the plaintext m. The first-level ciphertext ct1 is divided into two parts:

[0474] Wherein

[0475] Further, step 206 specifically includes the following sub-steps:

[0476] Call the fault-tolerant learning inverse algorithm to inverse the LWE instance composed of the upper half ciphertext with the trapdoor T to obtain (s, e). The formula of the fault-tolerant learning inverse algorithm is:

[0477] Calculate

[0478] For each component of Determine whether is true; if so, set the i-th component of m Otherwise And output m.

[0479] In step 207, the formula of the second-level ciphertext decryption algorithm is: m <- fgDec2 (sk = 9T, K), ct2), which takes the second-level ciphertext ct2 and the corresponding private key sk as input and outputs the plaintext m.

[0480] Further, step 207 specifically includes the following sub-steps:

[0481] Concatenate the matrix K in the private key with the identity matrix To get Calculate:

[0482]

[0483] For each component of Determine whether is true; if so, set the i-th component of m Otherwise And output m.

[0484] The correctness of the above ciphertext hierarchical single-hop proxy re-encryption method for linear proxy function set is demonstrated as follows:

[0485] 1. Basic encryption and decryption correctness of the first-level ciphertext:​​

[0486] If the primary ciphertext ct1 is the output of the primary encryption algorithm (step 202), it can be considered as:

[0487]

[0488] The upper half is a fault-tolerant learning instance, and T is solved to get Calculate When , the above decryption method can correctly decrypt and restore m.

[0489] 2. The basic encryption and decryption correctness of the secondary ciphertext:

[0490] If the secondary ciphertext ct s is the output of the secondary encryption algorithm (step 203), it can be considered as:

[0491]

[0492] Note that Therefore:

[0493]

[0494] The absolute value of each component of the noise terms e1, e2 in ct2 is not more than B, and since When , the above decryption method can correctly decrypt and restore m.

[0495] 3. Encryption and decryption correctness of the re-encrypted ciphertext:

[0496] For the ciphertext obtained by the primary encryption algorithm (step 202), perform single re-encryption (step 205) on it, and the obtained re-encrypted ciphertext (secondary ciphertext) is:

[0497]

[0498] Since , we have Therefore:

[0499]

[0500] It can be seen that the re-encrypted is indeed the secondary ciphertext of the information Mm under the A (2) public key, according to the definition of , we know that ||Mm|| ∞ ≤p-1, and at the same time, the new noise e' has the following The noise range of the row changes to In combination with the basic decryption correctness of the secondary ciphertext, as long as there is The above decryption method can correctly decrypt and restore Mm.

[0501] Further, preferably,

[0502] In some embodiments, the secondary ciphertext includes a secondary ciphertext generated by secondary encryption (step 203) and a secondary ciphertext generated by proxy re-encryption (step 205).

[0503] In some embodiments, the step 204 further includes: inputting the public and private keys pk (1) ,k (1) and the public and private keys pk (2) ,sk (2) of the delegatee into a fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the delegator to the delegatee

[0504] The ciphertext hierarchical single-hop proxy re-encryption method of the present application, compared with the multi-hop proxy re-encryption method, allows the delegator to flexibly choose the encryption method according to his own needs, and thus determines whether the ciphertext can be re-encrypted; at the same time, the re-encryption operation can only be performed once, effectively preventing the ciphertext propagation chain from being uncontrollably extended. In addition, the ciphertext hierarchical single-hop proxy re-encryption method can be extended to a fine-grained proxy re-encryption scheme, realizing fine-grained decryption authorization.

[0505] In summary, the present application provides three ciphertext hierarchical single-hop proxy re-encryption methods with post-quantum security and encrypted multi-bit plaintext, namely a basic ciphertext hierarchical single-hop proxy re-encryption method, a ciphertext hierarchical single-hop proxy re-encryption method with information deletion property, and a proxy re-encryption method for a linear proxy function set, which have higher security, higher encryption efficiency, and can realize fine-grained decryption authorization of the ciphertext, and can allow users to freely choose whether the ciphertext can be re-encrypted, thereby being able to block further ciphertext conversion.

[0506] The above three schemes all have single-hop, one-way, non-interactive, unlinkable, collusion-resistant security, post-quantum semantic security, and many other good properties, and one encryption can encrypt multiple bits of plaintext at the same time, with high encryption efficiency. The analysis and reasons are as follows:

[0507] 1. Single-hop.

[0508] Given the system public parameters The public key pk (1) of user 1 = (A (1) ,A′ (1) User 2's public key pk (2) =(A (2) , A ′ (2) From this, we can know the proxy key rk obtained by the proxy. 1→2 Only with A (1) Related trapdoor T (1) and A′ (2) Related. When the agent obtains the secondary ciphertext facing user 1. Later, because the K key in user 1's private key was unknown... (1) Information, and I don't know about The trapdoor contains no information, hence the difficulty of fault-tolerant learning problems. It exhibits pseudo-randomness for agents. Therefore, agents... The proxy is completely unaware of the plaintext information 'm' hidden within, therefore it cannot generate a valid ciphertext that is user-facing and encrypts 'm'. This demonstrates that the proxy cannot re-encrypt the secondary ciphertext. Since the primary ciphertext becomes secondary ciphertext after being proxied, it cannot be proxied again after a single hop, thus achieving single-hop propagation.

[0509] 2. Unidirectionality.

[0510] Given system public parameters User 1's public key pk (1) =(A (1) , A′ (1) User 2's public key pk (2) =(A (2) , A′ (2) From this, we can know the proxy key rk obtained by the proxy. 1→2 Only with A (1) Related trapdoor T (1) and A′ (2) Related. The agent only has the agent key rk. 1→2 And without rk 2→1 In this case, due to the difficulty of fault-tolerant learning problems, the first-level ciphertext for user 2... It exhibits pseudo-randomness for agents. Therefore, agents... Since the plaintext information m hidden within is unknown, it is impossible to generate a valid ciphertext that is directed to user 1 and encrypts m. Therefore, one-way communication is achieved.

[0511] 3. Non-interactive.

[0512] In all three methods described above, the proxy key calculation from user 1 to user 2 does not require user 2's private key as input; therefore, these methods are non-interactive.

[0513] 4. unlinkability.

[0514] In the above three methods, according to the correctness of the ciphertext hierarchical single-hop proxy re-encryption method, the re-encrypted ciphertext is consistent with the secondary ciphertext format generated by direct encryption, which is an LWE sample instance, that is, According to the difficulty of the fault-tolerant learning problem, the above two types of ciphertexts are indistinguishable from the uniform distribution, so the above three methods have unlinkability / proxy invisibility.

[0515] 5. collusion resistance security.

[0516] The proxy key is generated in the following way According to the difficulty of the fault-tolerant learning problem, A' (2) S+E has a pseudo-random characteristic, and then has a pseudo-random characteristic. According to the properties of the SamplePre algorithm, the original image of the uniformly distributed elements is sampled, and the original image distribution is independent of the Gaussian distribution, which is independent of the public and private keys of user 1 and user 2, so that rk 1→2 will not leak any information about the private key of user 1. Therefore, even if the proxy colludes with user 2, the private key of user 1 cannot be obtained. Therefore, collusion resistance security can be achieved.

[0517] 6. Post-quantum semantic security.

[0518] In the above three methods, the form of the ciphertext is According to the difficulty of the fault-tolerant learning problem, the distribution of the ciphertext is indistinguishable from the uniform distribution. Therefore, the ciphertext can perfectly cover the information of m. In this way, the security of the method can be reduced to the difficulty of the fault-tolerant learning problem. Since the fault-tolerant learning problem is a post-quantum difficult problem, our proxy re-encryption method has the post-quantum security feature of resisting quantum attacks.

[0519] For the proxy re-encryption method with information deletion property, fine-grained decryption authorization is embodied in the deletion of the original plaintext message; for the proxy re-encryption method for linear proxy function set, fine-grained decryption authorization is embodied in the linear function calculation of the original plaintext message.

[0520] The concepts and specific methods proposed in this application expand the application scenarios of proxy re-encryption technology and provide more technical route options for solving real-world problems. According to different scenarios, users can flexibly choose the above different methods to achieve flexible authorization of ciphertext decryption.

[0521] It has to be noted that, with respect to the claims and the specification as a whole, relative terms such as first and second, and the like can be used merely for distinguishing between certain elements of the specification and the claims from other elements, without necessarily requiring or implying any actual relationship or order between such elements. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0522] While the application has been illustrated and described in detail in the drawings and foregoing description, the same is to be considered as illustrative and not restrictive in character, it being understood that only the preferred embodiments have been shown and described and that all changes and modifications that come within the spirit of the application are desired to be protected.

Claims

1. A method for hierarchical single-hop proxy re-encryption of ciphertext, characterized in that, Includes the following steps: Key generation involves inputting security parameters into a key generation algorithm to generate a public-private key pair. Level 1 encryption involves inputting the public key and plaintext into the Level 1 encryption algorithm to generate the Level 1 ciphertext corresponding to the plaintext. Secondary encryption involves inputting the public key and plaintext into a secondary encryption algorithm to generate secondary ciphertext corresponding to the plaintext. The proxy key generation process involves inputting the principal's public and private keys and the agent's public key into the proxy key generation algorithm to generate a proxy key from the principal to the agent. The proxy re-encryption process involves inputting the primary ciphertext (for the principal) and the proxy key into the re-encryption algorithm to generate a secondary ciphertext (for the agent). Level 1 ciphertext decryption involves inputting the level 1 ciphertext and the corresponding private key into the level 1 ciphertext decryption algorithm to obtain the plaintext corresponding to the level 1 ciphertext. Second-level ciphertext decryption involves inputting the second-level ciphertext and the corresponding private key into the second-level ciphertext decryption algorithm to obtain the plaintext corresponding to the second-level ciphertext. The first-level ciphertext can be re-encrypted into the second-level ciphertext, but the second-level ciphertext cannot be re-encrypted. The key generation algorithm is expressed as: (sk,pk)←KeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, generate a public-private key pair (sk, pk); The key generation steps specifically include: The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q; Randomly generated Obtained by matrix concatenation: Randomly select K∈{-1,0,1} l×N Randomly select public parameters calculate Set the public key to pk = (A, A Set the private key to sk = (T, K) and output the public-private key pair (sk, pk); The formula for the first-level encryption algorithm is expressed as: ct1←Enc1(pk=(A, A m∈{0,1} l This first-level encryption algorithm takes the public key pk and plaintext m as input and outputs the first-level ciphertext ct1 corresponding to the plaintext m. The first-level ciphertext ct1 can be re-encrypted into second-level ciphertext. The plaintext space... Cipherspace The steps of the first-level encryption specifically include: Randomly select s←χ n ,e←χ N+l , where χ is The discrete Gaussian distribution on the output path yields the first-level ciphertext ct1 corresponding to the plaintext m as follows: The formula for the second-level encryption algorithm is: ct2←Enc2(pk=(A, A m∈{0,1} l This two-level encryption algorithm takes a public key pk and plaintext m as input and outputs the corresponding second-level ciphertext ct2. This second-level ciphertext ct2 cannot be re-encrypted. The plaintext space... Cipherspace The steps of the secondary encryption specifically include: Public parameters and A By splicing the ''s together, we get: Randomly select s←χ n ,e←χ N+l , where χ is The discrete Gaussian distribution on the output path yields the second-level ciphertext ct2 corresponding to the plaintext m as follows: The formula for the proxy key generation algorithm is as follows: rk 1→2 ←ReKeyGen(pk (1) =(A (1) , A ′ (1) ),sk (1) =(T (1) ,K (1) ),pk (2) =(A (2) , A ′ (2) )), The proxy key generation algorithm uses the principal's public and private keys (pk) to generate the key. (1) ,sk (1) PK with the entrusted person's public key (2) As input, generate the proxy key rk from principal to agent. 1→2 ; The steps for generating the proxy key specifically include: Public parameters and A ′ (2) By splicing them together, we get: Random selection E←χ (N+l)×n The preimage generation algorithm SamplePre is invoked to calculate R; the formula for SamplePre is as follows: Where the dimension of matrix R is (N+l)×N, and I is an l×l identity matrix, let rk 1→2 =R, and output the proxy key rk 1→2 ; The formula for the re-encryption algorithm is expressed as follows: This re-encryption algorithm uses the principal-to-proxy proxy key rk. 1→2 and the principal-facing first-level encrypted message The input is a secondary encrypted message directed to the agent. The secondary encrypted message It cannot be re-encrypted; The specific steps of the proxy re-encryption include: Based on the input R, obtain the matrix. Its dimension is (N+l)×(N+l); According to the formula Calculate and output the secondary ciphertext for the entrusted party. The formula for the first-level ciphertext decryption algorithm is: m←Dec1(sk=(T,K),ct1). This first-level ciphertext decryption algorithm takes the first-level ciphertext ct1 and the corresponding private key sk as input, and outputs the plaintext m corresponding to the first-level ciphertext ct1, dividing the first-level ciphertext ct1 into two parts: in The specific steps for decrypting the first-level ciphertext include: The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows: calculate for Each component judge Is it true? If so, then set the i-th component m of m. i := 1, otherwise m i Set :=0 and output plaintext m; The formula for the second-level ciphertext decryption algorithm is: m←Dec2(sk=(T,K),ct2), which takes the second-level ciphertext ct2 and the corresponding private key sk as input and outputs the plaintext m corresponding to the second-level ciphertext ct2. The specific steps for decrypting the secondary ciphertext include: Compare matrix K in the private key with the identity matrix I. l×l splicing together (K) l×N |I l×l ) l×(N+l) ,calculate: for Each component judge Is it true? If so, then set m. i := 1, otherwise m i = 0, and output plaintext m.

2. The ciphertext hierarchical single-hop proxy re-encryption method according to claim 1, characterized in that, The secondary ciphertext includes the secondary ciphertext generated by secondary encryption and the secondary ciphertext generated by proxy re-encryption.

3. The ciphertext hierarchical single-hop proxy re-encryption method according to claim 1, characterized in that, The proxy key generation step further includes: inputting the principal's public and private keys and the agent's public and private keys into the proxy key generation algorithm to generate a proxy key from the principal to the agent.

4. A hierarchical single-hop proxy re-encryption method for fine-grained proxy function sets, characterized in that, Includes the following steps: Key generation involves inputting security parameters into a key generation algorithm to generate a public-private key pair. Level 1 encryption involves inputting the public key and plaintext into the Level 1 encryption algorithm to generate the Level 1 ciphertext corresponding to the plaintext. Secondary encryption involves inputting the public key and plaintext into a secondary encryption algorithm to generate secondary ciphertext corresponding to the plaintext. Fine-grained proxy key generation involves inputting the principal's public and private keys, the agent's public key, and the fine-grained proxy function into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent. The proxy re-encryption algorithm takes the primary ciphertext for the principal and the fine-grained proxy key and inputs them into the re-encryption algorithm to generate the secondary ciphertext for the agent. Level 1 ciphertext decryption involves inputting the level 1 ciphertext and the corresponding private key into the level 1 ciphertext decryption algorithm to obtain the plaintext corresponding to the level 1 ciphertext. Second-level ciphertext decryption involves inputting the second-level ciphertext and the corresponding private key into the second-level ciphertext decryption algorithm to obtain the plaintext corresponding to the second-level ciphertext. The first-level ciphertext can be re-encrypted into the second-level ciphertext, but the second-level ciphertext cannot be re-encrypted. Wherein, the fine-grained proxy function is the information deletion proxy function f. pos ; The ciphertext hierarchical single-hop proxy re-encryption method for fine-grained proxy function sets specifically includes: Let plain text space Cipherspace Where 0 and 1 represent normal information bits, and * represents invalid information bits, a family of functions is defined. For any input The information deletion proxy function f pos Defined as When i∈pos, m i ′:=*; otherwise, m i ′:=m i The above function set is a set of information deletion proxy functions. The information bit with the index in the set pos will be deleted and set to an invalid information bit. The key generation algorithm is expressed as: (sk,pk)←fgKeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, generate a public-private key pair (sk, pk); The key generation steps specifically include: The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q; Randomly generated The matrix is ​​concatenated to obtain: Randomly select K∈{-1,0,1} 2l×N Randomly select public parameters calculate Set the public key to pk = (A, A Set the private key to sk = (T, K) and output the public-private key pair (sk, pk); The formula for the first-level encryption algorithm is: ct1←fgEnc1(pk,m∈{0,1,*} l The first-level encryption algorithm takes the public key pk and plaintext m as input and outputs the first-level ciphertext ct1 corresponding to the plaintext m. The first-level ciphertext ct1 can be re-encrypted into a second-level ciphertext. The steps of the first-level encryption specifically include: Encode the plaintext m, where the encoding algorithm is expressed by the formula: m E ←Encode(m) is an encoding algorithm that takes plaintext m as input and outputs the encoded value m. E ; The encoding steps specifically include: by For input, output encoded value m E ∈{0,1} 2l For m E The (2i-1)th and 2ith bits, where i∈[1,l], have the following encoding rules: Output Randomly select s←χ n ,e←χ N+2l , where χ is The discrete Gaussian distribution on the output path yields the first-level ciphertext ct1 corresponding to the plaintext m as follows: The formula for the second-level encryption algorithm is expressed as: ct2←fgEnc2(pk=(A, A m∈{0,1,*} l The two-level encryption algorithm takes the public key pk and the plaintext m as input and outputs the second-level ciphertext ct2 corresponding to the plaintext m. The second-level ciphertext ct2 cannot be re-encrypted. The steps of the secondary encryption specifically include: Encode the plaintext m, where the encoding algorithm is expressed by the formula: m E ←Encode(m) is an encoding algorithm that takes plaintext m as input and outputs the encoded value m. E ; Public parameters and A By splicing the ''s together, we get: Randomly select s←χ n ,e←χ N+2l , where χ is The discrete Gaussian distribution on the output path yields the second-level ciphertext ct2 corresponding to the plaintext m as follows: The formula for the fine-grained proxy key generation algorithm is expressed as follows: This fine-grained proxy key generation algorithm uses the principal's public and private keys (pk) (1) ,sk (1) PK with the entrusted person's public key (2) and the information deletion proxy function f pos As input, output a fine-grained proxy key from principal to agent. The steps for generating the fine-grained proxy key specifically include: According to f pos Function, setting matrix I pos ∈{0,1} 2l×2l For i∈[l], and The settings rules are as follows: In addition to the above locations, I pos All other positions are set to 0; Public parameters and A ′ (2) By splicing them together, we get: Random selection E←χ (N+2l)×n The preimage generation algorithm SamplePre is invoked to calculate R; the formula for SamplePre is as follows: The dimension of matrix R is (N+2l)×N, and it outputs a fine-grained proxy key. The formula for the re-encryption algorithm is expressed as follows: This re-encryption algorithm uses a fine-grained proxy key from the principal to the agent. and the principal-facing first-level encrypted message The input is a secondary encrypted message directed to the agent. The secondary encrypted message It cannot be re-encrypted; The specific steps of the proxy re-encryption include: calculate It also outputs secondary encrypted text to the entrusted party. The formula for the first-level ciphertext decryption algorithm is: m←fgDec1(sk=(T,K),ct1). This first-level ciphertext decryption algorithm takes the first-level ciphertext ct1 and the corresponding private key sk as input and outputs plaintext m, dividing the first-level ciphertext ct1 into two parts: in The specific steps for decrypting the first-level ciphertext include: The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor t is used to invert (S,E). The formula of the fault-tolerant learning inversion algorithm is expressed as follows: calculate for Each component judge Is it true? If so, then set the i-th component m′. i ′:=1, otherwise m i ′:=0; Decode m′ and output m←Decode(m′); where the decoding algorithm is expressed as: m D ←Decode(m E The decoding algorithm uses the encoded value m E The input is the decoded value m, and the output is the decoded value m. D ; The decoding steps specifically include: With m E ∈{0,1} 2l Input is the decoded value. For m D The j-th component, j∈[l], has the following mapping relationship: Output The formula for the second-level ciphertext decryption algorithm is: m←fgDec2(sk=(T,K),ct2), which takes the second-level ciphertext ct2 and the corresponding private key sk as input and outputs the plaintext m. The specific steps for decrypting the secondary ciphertext include: Compare matrix K in the private key with the identity matrix I. 2l×2l splicing together (K) 2l×N |I 2l×2l ) 2l×(N+2l) ; calculate: for Each component judge Is it true? If so, then set the i-th component m′. i ′:=1, otherwise m i ′:=0; Decode m′ and output m←Decode(m′).

5. The ciphertext hierarchical single-hop proxy re-encryption method for fine-grained proxy function sets according to claim 4, characterized in that, The secondary ciphertext includes the secondary ciphertext generated by secondary encryption and the secondary ciphertext generated by proxy re-encryption.

6. The ciphertext hierarchical single-hop proxy re-encryption method for fine-grained proxy function sets according to claim 4, characterized in that, The fine-grained proxy key generation step further includes: inputting the principal's public and private keys, the agent's public and private keys, and the fine-grained proxy function into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent.

7. A hierarchical single-hop proxy re-encryption method for ciphertext based on a fine-grained proxy function set, characterized in that, Includes the following steps: Key generation involves inputting security parameters into a key generation algorithm to generate a public-private key pair. Level 1 encryption involves inputting the public key and plaintext into the Level 1 encryption algorithm to generate the Level 1 ciphertext corresponding to the plaintext. Secondary encryption involves inputting the public key and plaintext into a secondary encryption algorithm to generate secondary ciphertext corresponding to the plaintext. Fine-grained proxy key generation involves inputting the principal's public and private keys, the agent's public key, and the fine-grained proxy function into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent. The proxy re-encryption algorithm takes the primary ciphertext for the principal and the fine-grained proxy key and inputs them into the re-encryption algorithm to generate the secondary ciphertext for the agent. Level 1 ciphertext decryption involves inputting the level 1 ciphertext and the corresponding private key into the level 1 ciphertext decryption algorithm to obtain the plaintext corresponding to the level 1 ciphertext. Second-level ciphertext decryption involves inputting the second-level ciphertext and the corresponding private key into the second-level ciphertext decryption algorithm to obtain the plaintext corresponding to the second-level ciphertext. The first-level ciphertext can be re-encrypted into the second-level ciphertext, but the second-level ciphertext cannot be re-encrypted. Wherein, the fine-grained surrogate function is a linear surrogate function f M ; The ciphertext hierarchical single-hop proxy re-encryption method for fine-grained proxy function sets specifically includes: Choose parameter p such that q = p 2 ;Let plaintext space If the norm of the plaintext is small, then fine-grained surrogate re-encryption is performed; assuming the norm of the plaintext does not exceed Δ, a set of linear surrogate functions is defined. as follows: Plaintext space Cipher space is The key generation algorithm is expressed as: (sk,pk)←fgKeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, output public-private key pair (sk, pk); The key generation steps specifically include: The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; the formula for the trapdoor generation algorithm TrapGen is expressed as follows: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q; Randomly generated The matrix is ​​concatenated to obtain: Randomly select K∈{-1,0,1} l×N Randomly select public parameters calculate Set the public key to pk = (A, A Set the private key to sk = (T, K) and output the public-private key pair (sk, pk); The formula for the first-level encryption algorithm is expressed as follows: The first-level encryption algorithm takes the public key pk and plaintext m as input and outputs the first-level ciphertext ct1 corresponding to the plaintext m. The first-level ciphertext ct1 can be re-encrypted into a second-level ciphertext. The steps of the first-level encryption specifically include: Randomly select s←χ n ,e←χ N+l , where χ is The discrete Gaussian distribution on the output path yields the first-level ciphertext ct1 corresponding to the plaintext m as follows: The formula for the second-level encryption algorithm is as follows: This two-level encryption algorithm takes the public key pk and plaintext m as input and outputs the two-level ciphertext ct2 corresponding to the plaintext m. This two-level ciphertext ct2 cannot be re-encrypted. The steps of the secondary encryption specifically include: Public parameters and A By splicing the ''s together, we get: Randomly select s←χ n ,e←χ N+l , where χ is The discrete Gaussian distribution on the output path yields the second-level ciphertext ct2 corresponding to the plaintext m as follows: The formula for the fine-grained proxy key generation algorithm is expressed as follows: sk (1) =(T (1) ,K (1) ), This fine-grained proxy key generation algorithm uses the principal's public and private keys (pk) (1) ,sk (1) PK with the entrusted person's public key (2) and the linear surrogate function f M As input, generate a fine-grained proxy key from principal to agent. The steps for generating the fine-grained proxy key specifically include: Public parameters and A ′ (2) By splicing them together, we get: Random selection E←x (N+l)×n Call the preimage generation algorithm SamplePre to calculate R, and then use f M Using the matrix as input embedding, the formula for the preimage generation algorithm SamplePre is expressed as: The dimension of matrix R is (N+1)×N, set as follows: Its dimension is (N+l)×(N+l); The formula for the re-encryption algorithm is expressed as follows: This re-encryption algorithm uses a fine-grained proxy key from the principal to the agent. And the first-level encrypted message to the client The input is a secondary encrypted message directed to the agent. The secondary encrypted message It cannot be re-encrypted; The specific steps of the proxy re-encryption include: calculate It also outputs secondary encrypted text to the entrusted party. The formula for the first-level ciphertext decryption algorithm is: m←fgDec1(sk=(T,K),ct1). This first-level ciphertext decryption algorithm takes the first-level ciphertext ct1 and the corresponding private key sk as input and outputs plaintext m, dividing the first-level ciphertext ct1 into two parts: in The specific steps for decrypting the first-level ciphertext include: The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows: calculate for Each component judge Is it true? If so, then set the i-th component of m. otherwise And output m; The formula for the second-level ciphertext decryption algorithm is: m←fgDec2(sk=(T,K),ct2), which takes the second-level ciphertext ct2 and the corresponding private key sk as input and outputs the plaintext m. The specific steps for decrypting the secondary ciphertext include: Compare matrix K in the private key with the identity matrix I. l×l splicing together (K) l×N |I l×l ) l×(N+l) ,calculate: for Each component judge Is it true? If so, then set the i-th component of m. otherwise And output m.

8. The ciphertext hierarchical single-hop proxy re-encryption method for fine-grained proxy function sets according to claim 7, characterized in that, The secondary ciphertext includes the secondary ciphertext generated by secondary encryption and the secondary ciphertext generated by proxy re-encryption.

9. The ciphertext hierarchical single-hop proxy re-encryption method for fine-grained proxy function sets according to claim 7, characterized in that, The fine-grained proxy key generation step further includes: inputting the principal's public and private keys, the agent's public and private keys, and the fine-grained proxy function into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent.

Images